Microsoft is hiring a Senior Security Assurance Engineer for its Marketing Security Risk & Compliance team in Redmond, Washington — a hybrid role (3 days per week in-office) for experienced software engineers with a security background. The position was posted on 2 October 2026 and remains open on an ongoing basis until filled.
Role Overview
The Marketing Security Risk & Compliance team leads complex security reviews and threat modeling for Microsoft Marketing services, platforms, and data — a diverse technology estate spanning cloud services, data platforms, business applications, AI solutions, and complex integrations. The team partners with engineering and business organizations to identify and address security risk through security reviews, threat modeling, Secure Development Lifecycle practices, data-driven analysis, and continuous remediation.
In this role, you will provide senior technical security assurance across a portfolio of Marketing services: leading security reviews for complex services and high-impact initiatives, evaluating technical architectures and security evidence, identifying material security risks, and partnering with engineering teams to drive findings through remediation and closure. You will also help modernize security assurance from primarily manual, point-in-time reviews toward a scalable, intelligence-driven model combining service data, cloud telemetry, automated evidence collection, AI-assisted analysis, and expert engineering judgment.
Key Details
| Detail | Information |
|---|---|
| Job title | Senior Security Assurance Engineer – Marketing Security Risk & Compliance |
| Job number | 200058419 |
| Company | Microsoft |
| Location | Redmond, Washington, United States |
| Work site | Hybrid – 3 days per week in-office |
| Employment type | Full-time |
| Level | Individual Contributor (IC4) |
| Profession | Software Engineering |
| Travel | Less than 25% |
| Date posted | 2 October 2026 |
| Application deadline | No fixed date; open until filled (minimum 5 days) |
Salary and Benefits
The typical base pay range for this role across the U.S. is USD $119,800 – $234,700 per year. For specific work locations in the San Francisco Bay Area and New York City metropolitan area, the base pay range is USD $160,200 – $261,000 per year. Certain roles may be eligible for additional benefits and compensation.
Microsoft highlights four benefit areas: Flexibility (balancing work, life, and team through trust and autonomy), Growth (expanding skills and impact with structured support), Wellbeing (support for body, mind, and financial future), and Community (networks and support at every step).
Responsibilities
- Lead end-to-end security reviews and threat-modeling engagements for complex Marketing services, applications, platforms, and data environments.
- Analyze architecture, data flows, trust boundaries, identities, endpoints, privileged access, network exposure, dependencies, logging, cloud configurations, and security controls.
- Apply Microsoft security requirements and Secure Development Lifecycle practices to identify design weaknesses, implementation risks, control gaps, and missing evidence.
- Lead security assurance for high-impact initiatives, including tenant migrations, new platforms, AI solutions, sensitive-data environments, and major architectural changes.
- Facilitate technical security discussions with service owners, developers, architects, security and privacy teams, Responsible AI practitioners, and technical partners.
- Validate automated and AI-assisted findings, distinguish material risk from false positives, and focus engineering teams on risks requiring action.
- Document validated findings with clear severity, impact, remediation requirements, ownership, and closure evidence, and track remediation through closure.
- Build and operationalize automation for evidence collection, security analysis, risk identification, reporting, and remediation workflows.
- Identify recurring control failures and systemic risks, translating them into reusable guidance, secure design patterns, and improved review practices (Secure by Design, Secure by Default, Secure Operations).
- Contribute to review standards, playbooks, templates, decision frameworks, and training; provide technical guidance and mentoring to Security Assurance Engineers.
Required Qualifications
Bachelor’s degree in Computer Science or a related technical field AND 4+ years of technical engineering experience with coding in languages including, but not limited to, C, C++, C#, Java, JavaScript, or Python — or equivalent experience.
Preferred Qualifications
- Master’s degree in Computer Science or related field AND 6+ years of technical engineering experience with coding, OR Bachelor’s degree AND 8+ years of such experience — or equivalent.
- Experience conducting or leading security architecture reviews, threat modeling, application or cloud security assessments, or Secure Development Lifecycle activities.
- Experience assessing cloud architectures and security controls across identity, networking, data protection, applications, infrastructure, secrets management, logging, monitoring, and DevOps.
- Experience identifying security vulnerabilities, architectural weaknesses, and control gaps, and making risk-based technical recommendations in complex engineering environments.
- Experience working with engineering teams to translate security findings into actionable remediation and validate evidence through closure.
- Strong understanding of threat-modeling methodologies, secure architecture principles, attack paths, data flows, and trust boundaries.
- Experience securing Microsoft Azure services, hybrid environments, data platforms, Power Platform, Dynamics 365, or AI systems.
- Experience with platforms such as Azure DevOps, Microsoft Purview, Defender for Cloud, CodeQL, or similar tools.
- Experience using automation, data analysis, or AI-assisted capabilities to improve security assessment and remediation workflows.
- Security certifications such as CISSP, CSSLP, CCSP, GIAC, or comparable credentials.
How to Apply
There is no fixed closing date: the position stays open for a minimum of 5 days, with applications accepted on an ongoing basis until the role is filled. Since this posting was published on 2 October 2026, interested candidates should apply as early as possible through the official Microsoft Careers page. The posting does not state visa sponsorship terms, so international applicants should review the official listing and Microsoft’s hiring policies before applying.
